Description
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.
Remediation
References
Related Vulnerabilities
WordPress Plugin WooCommerce Help Scout Arbitrary File Upload (2.9)
WordPress Plugin Super CAPTCHA 'admin.php' SQL Injection (2.2.4)
Drupal Core 9.0.0 Cross-Site Request Forgery (9.0.0)
Joomla URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-24598)
Atlassian Jira Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-8451)